Getting Data In

Indexer Problem: ERROR TcpChannel - Fatal error on accept socket: Software caused connection abort

chris
Motivator

Hi

we get the following error message from time to time on our Indexers (Solaris 10 x86 64bit Splunk 4.2.5 or 4.3):

ERROR TcpChannel - Fatal error on accept socket: Software caused connection abort

If this occurs netstat shows that the port is still listening:


~:netstat -an | grep 99
.9997 *. 0 0 49152 0 LISTEN

But i do not get a connection when telneting to the port, the forwarders can't connect to the indexer anymore and it has to be restarted.

Is there anyone else with the same problem somewhere? Is there a fix for this?

Thanks for helping

Chris

Edit:

We have downgraded to 4.2.4 on one of our indexers, we haven't had the problem since then. But it has only been running for a couple of hours now. I will update this when more time has passed

Tags (2)
0 Karma
1 Solution

chris
Motivator

According to Splunk support this Issue wil be fixed in 4.3.1.
Apparently the root cause of the problem is, that busy indexers can't send TCP Acks fast enough.

View solution in original post

chris
Motivator

According to Splunk support this Issue wil be fixed in 4.3.1.
Apparently the root cause of the problem is, that busy indexers can't send TCP Acks fast enough.

Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...